Because you have only configured the VLAN on the external bridge ports and missed the implicit bridge-to-CPU port setup for management access per https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Management_access_configuration, see http://forum.mikrotik.com/t/routeros-bridge-mysteries-explained/147832/1 for a detailed explanation.
Using more than one bridge is not recommended as on CRS3xx you loose hardware offload for ports attached to anything other than the first bridge.